1

If I create a file named /home/martin/testfile.txt, open this file with less utility, delete /home/martin/testfile.txt file and restore it from file descriptor directory under the /proc/31148, where 31148 is the PID of the less utility, then lsof | grep testfile.txt still shows testfile.txt as deleted:

martin@potato:~$ echo test > testfile.txt
martin@potato:~$ ls -li ~/testfile.txt
247 -rw-r--r-- 1 martin martin 5 24. veebr 05:02 /home/martin/testfile.txt
martin@potato:~$ xterm -hold -e "less /home/martin/testfile.txt" &
[1] 31145
martin@potato:~$ lsof | grep testfile.txt
less      31148      martin    4r      REG                8,9        5        247 /home/martin/testfile.txt
martin@potato:~$ rm -v /home/martin/testfile.txt
removed `/home/martin/testfile.txt'
martin@potato:~$ lsof | grep testfile.txt
less      31148      martin    4r      REG                8,9        5        247 /home/martin/testfile.txt (deleted)
martin@potato:~$ cp -v /proc/31148/fd/4 /home/martin/testfile.txt
`/proc/31148/fd/4' -> `/home/martin/testfile.txt'
martin@potato:~$ ls -li ~/testfile.txt
263 -rw-r--r-- 1 martin martin 5 24. veebr 05:04 /home/martin/testfile.txt
martin@potato:~$ cat ~/testfile.txt
test
martin@potato:~$ lsof | grep testfile.txt
less      31148      martin    4r      REG                8,9        5        247 /home/martin/testfile.txt (deleted)
martin@potato:~$ 

Is this because testfile.txt got a new inode number? Or is there some other reason why lsof displays restored file as deleted?

1 Answer 1

3

Yes, they are two different files. By copying (cp) the file from /proc, you are simply creating a new file with a new inode. You can test it with the statcommand -

[root@server2 tmp]# stat testfile.txt File: test.txt Size: 9 Blocks: 8 IO Block: 4096 regular file Device: 803h/2051d Inode: 3684616 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2013-02-23 19:01:14.000679872 -0800 Modify: 2013-02-23 19:01:14.000679872 -0800 Change: 2013-02-23 19:01:14.000679872 -0800

[root@server2 tmp]# stat testfile.txt File: test.txt Size: 9 Blocks: 8 IO Block: 4096 regular file Device: 803h/2051d Inode: 3684617 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2013-02-23 19:02:46.422854012 -0800 Modify: 2013-02-23 19:02:44.507799688 -0800 Change: 2013-02-23 19:02:44.507799688 -0800

2
  • Try using mv and observing the behaviour. mv is useful if you want/need to preserve everything about the file including the inode and excepting the name. You can then cp the mv'ed file back into place with the old name.
    – gm3dmo
    Feb 24, 2013 at 9:06
  • @davey But it isn't possible to move a file under /proc directory, is it? For example: if I execute martin@potato:~$ mv -f /proc/3688/fd/4 /home/martin/testfile.txt, I receive mv: cannot remove /proc/3688/fd/4': Permission denied` error.
    – Martin
    Feb 24, 2013 at 15:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .